A finance director receives an apparently routine request from the chief executive: amend supplier bank details before an urgent payment run. The language is familiar, the signature looks right, and the attacker may have spent weeks observing the organisation’s email traffic. This is why the top business email compromise controls cannot rely on a spam filter alone. They must prevent impersonation, interrupt fraudulent processes and give security teams a way to find and remove related messages quickly.
Business email compromise, or BEC, is a social-engineering problem with technical and operational dimensions. Attackers exploit trusted relationships, compromised accounts and weak payment verification processes. The most damaging incidents often contain no obvious malware, which means conventional endpoint-focused controls may have little to investigate after a payment has been authorised.
Why BEC controls need to work together
A strong BEC defence is not a single product decision. Microsoft 365 security configuration, identity protection, employee reporting, phishing triage and financial controls each address a different point in the attack path. A gap between them is where fraud succeeds.
For example, email authentication can reduce direct domain spoofing, but it will not stop an attacker using a lookalike domain or a compromised supplier mailbox. Multi-factor authentication can make account takeover harder, but it will not protect an employee who receives a convincing request from a genuine external account. Payment verification can stop the transfer, but only if staff can challenge urgent requests without commercial pressure overriding the process.
The objective is therefore layered assurance: reduce the volume of malicious email reaching users, make deceptive requests easier to identify, ensure suspicious messages are reported, and contain confirmed threats before they spread.
Top business email compromise controls for UK organisations
Protect identities and Microsoft 365 administration
Compromised mailboxes are highly effective BEC assets. They allow attackers to reply within existing conversations, learn who approves payments and monitor the timing of transactions. Identity controls should therefore be treated as a core anti-fraud measure, not merely an access management requirement.
Enforce multi-factor authentication for all users, with particular attention to finance teams, senior leaders, administrators and remote access. Conditional access policies should restrict high-risk sign-ins, require stronger authentication where appropriate and prevent legacy authentication protocols from bypassing modern controls. Privileged roles need separate administrative accounts and tightly controlled access.
Security teams should also monitor for inbox rules, forwarding changes, unusual consent grants and unfamiliar sign-in activity. Attackers commonly create rules that hide replies, delete warnings or forward messages to external addresses. These indicators can reveal a compromise before a payment request is sent.
Configure email authentication and anti-impersonation protection
SPF, DKIM and DMARC remain essential controls for protecting an organisation’s own domain. A properly enforced DMARC policy makes it more difficult for criminals to send messages that appear to come directly from your legitimate email address. It also provides visibility into unauthorised use of the domain.
However, DMARC is not a complete BEC control. It cannot validate every supplier domain, detect every display-name impersonation or identify a fraudulent request sent from a compromised account. Microsoft 365 protection should therefore include anti-phishing and anti-impersonation policies, external sender identification, safe handling of suspicious URLs and attachments, and carefully managed allow lists.
Configuration needs regular review. Overly broad allow lists and permissive transport rules can quietly undermine otherwise effective protection. Conversely, aggressive filtering can disrupt legitimate supplier correspondence. The right balance depends on the organisation’s mail flow, sector and tolerance for quarantine-related administration, but exceptions should always have owners and expiry dates.
Make independent payment verification non-negotiable
The final opportunity to stop many BEC attacks sits outside the security operations centre. Finance and procurement teams need a documented process for changes to bank details, new beneficiary requests, payroll amendments and urgent payment instructions.
Verification must use a trusted, independently sourced channel. Replying to the email, calling the telephone number in the signature or using contact details provided in a suspicious message simply returns the employee to the attacker. Use a known number from approved supplier records, existing contractual documentation or a verified internal directory.
Segregation of duties matters here. No individual should be able to request, approve and release a material payment. Thresholds should reflect the organisation’s financial exposure, while exceptions and emergency payment routes need enhanced scrutiny rather than relaxed controls. Senior leadership support is crucial: staff must be able to pause a request that appears to come from an executive without fear of criticism for causing delay.
Turn employees into a reporting capability
BEC messages are designed to look credible, so awareness training should not reduce the issue to spotting poor spelling or generic greetings. Employees need to understand the behavioural signals attackers exploit: urgency, confidentiality, authority, process bypass and pressure to avoid normal checks.
Simulated phishing training is most useful when it measures and improves decision-making over time. Finance, payroll, HR, procurement and executive support staff may require scenarios tailored to the requests they genuinely receive. A generic campaign can establish a baseline, but role-specific exercises better reflect operational risk.
Just as important, employees need a simple way to report suspicious email in Outlook. Reporting should take seconds, not require forwarding headers to a shared mailbox or deciding whether an event is serious enough for the service desk. Clear feedback helps maintain participation. If users repeatedly report messages and hear nothing, reporting rates will fall precisely when the organisation needs early warning.
Triage reports quickly and remediate at scale
A single reported BEC email may be evidence of a broader campaign. The security team needs to determine whether similar messages reached other mailboxes, whether links or attachments were interacted with, and whether any sender account or internal account has been compromised.
This is where phishing triage and remediation become operationally significant. Analysts need the message context, threat indicators and an efficient route to classify the report. For confirmed threats, they should be able to search for matching messages across Microsoft 365 and remove them from affected inboxes. Manual mailbox-by-mailbox investigation is too slow when an attacker is targeting multiple recipients or rapidly changing lures.
Triage data should also inform prevention. Repeated supplier impersonation attempts may justify a targeted finance briefing, revised mail rules, a review of vendor onboarding controls or enhanced monitoring of specific domains. Threat intelligence has most value when it changes a control, a process or an investigative priority.
Build an incident path before fraud occurs
BEC response is often confused by the boundary between cyber incident management and financial fraud response. A practical playbook should set out who validates payment status, who contacts the bank, who preserves evidence, who resets credentials, and who communicates with affected suppliers or customers. Legal, finance, information security and communications teams may all have actions within the first hour.
Where a mailbox compromise is suspected, contain the account promptly. Revoke active sessions, reset credentials, review authentication methods, remove malicious inbox rules and examine recent sign-in and message activity. If payment instructions were acted upon, immediate contact with the bank may create a narrow opportunity to recall or freeze funds. Do not wait for a complete technical investigation before beginning financial containment.
The incident should then feed into a measured review. Was the message delivered because of a technical gap? Did the payment process allow a single email to override verification? Was it reported quickly enough? Did analysts have the tools and authority to remediate all copies? This approach turns a near miss or confirmed loss into evidence for human risk management, rather than another isolated awareness reminder.
Measure whether controls change risk
Security leaders need more than training completion rates and blocked-email totals. Useful BEC measures include report volume and quality, triage time, time to remediate confirmed phishing, the number of risky inbox configurations found, authentication coverage for high-risk users, and adherence to bank-detail change verification.
Metrics need interpretation. An increase in reported phishing may indicate a worsening campaign, but it may also show that employees now recognise and report suspicious messages. Similarly, low reporting is not automatically positive. In a large Microsoft 365 estate, it can indicate that users lack confidence in the process or that the reporting mechanism is poorly promoted.
Wise Fish approaches phishing defence as a lifecycle: prepare people, capture reports, analyse threats, remediate inboxes and use the resulting intelligence to improve controls. That operating model is particularly relevant to BEC because the attack is rarely defeated by one decision at one point in time.
The most useful next step is to test the path a fraudulent bank-detail request would take through your organisation this week. Follow it from delivery to report, triage, finance verification and remediation. The delays, assumptions and hand-offs revealed by that exercise will show where the next control investment should go.